In conventional elevator apparatuses, there are used a plurality of control systems, each of which compares its own input/output and results of calculation with those of the other system. If a difference obtained as a result of the comparison is out of an allowable error range, the control systems judges that a failure occurs in any of the systems to stop a control operation of an elevator (for example, see Patent Document 1).
Moreover, there is a safety control device for railways, in which each of control systems includes a healthy circuit for outputting a signal indicating whether its own system is in a normal state or a faulty state. When the signal indicating the faulty state is output from any of the healthy circuits, control operations of all the systems are stopped (for example, see Patent Document 2).
Patent Document 1: JP 2005-343602 A
Patent Document 2: JP 2000-255431 A